CVE-2026-46054: Linux Kernel Privilege Escalation Flaw

CVE-2026-46054 Overview

CVE-2026-46054 is a Linux kernel vulnerability in the SELinux security module's handling of overlayfs filesystems. The flaw affects access control enforcement during mmap() and mprotect() operations on files residing in overlay mounts. The existing SELinux security model for overlayfs requires that the current task can access the top-level user file and that the mounter's credentials suffice to access the lower backing file. The kernel did not properly enforce this dual-check policy for memory mapping operations, allowing access decisions to bypass the backing file evaluation.

Critical Impact
Tasks may map or change protections on overlayfs-backed files in ways that bypass SELinux access controls on the underlying backing file.

Affected Products

Linux kernel with SELinux enabled and overlayfs in use
Distributions shipping the affected mainline kernel revisions prior to the fix commits
Containerized environments relying on overlayfs (common in Docker, Podman, Kubernetes) with SELinux enforcement

Discovery Timeline

2026-05-27 - CVE-2026-46054 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46054

Vulnerability Analysis

The SELinux Linux Security Module (LSM) enforces a dual-credential access model for overlayfs. A task accessing an overlay file must satisfy two checks: the task's own credentials against the user file, and the mounter's credentials against the backing file in the lower layer. This split-credential model exists because the mounter and the accessing task often differ, particularly in container runtimes.

The kernel's mmap() and mprotect() paths did not consult the backing file when making SELinux access decisions. As a result, tasks could memory-map overlayfs files or alter page protections without the backing file's SELinux label being evaluated. This effectively bypassed half of the intended security model [CWE-863].

The fix introduces the security_mmap_backing_file() LSM hook to extend backing-file enforcement to mmap(). For mprotect(), the patch leverages the backing file API and a new LSM blob to carry the backing-file reference forward, enabling the security module to re-evaluate access at protection-change time.

Root Cause

The SELinux overlayfs hooks evaluated only the upper user file during memory-mapping operations. The backing file credential check, present for ordinary read and write paths, was not wired into the mmap() and mprotect() code paths. Without the backing file reference reaching the LSM at these decision points, the policy engine could not enforce the mounter-credential portion of the model.

Attack Vector

Local users with the ability to open files within an overlayfs mount can exploit the gap. By calling mmap() on an overlay file, a process obtains a mapping whose access has not been validated against the backing file's SELinux label. A subsequent mprotect() call can adjust page protections without triggering the backing-file check. In container workloads where overlayfs separates image layers and writable upper directories, this can grant a confined process effective access to content the SELinux policy intended to restrict.

The vulnerability manifests in the SELinux overlayfs file hooks. See the upstream commits 82544d36b172 and cd0e707a927a for the implementation details of the fix.

Detection Methods for CVE-2026-46054

Indicators of Compromise

Unexpected SELinux AVC denials appearing after applying the patch on hosts that previously ran without denials, indicating prior silent bypasses
Processes in confined SELinux domains holding executable or writable mappings of overlayfs backing files they should not access
Container workloads exhibiting access to lower-layer files inconsistent with the mounter's credentials

Detection Strategies

Audit kernel versions against the fix commits 82544d36b172 and cd0e707a927a to identify unpatched hosts
Enable SELinux audit logging in permissive mode on test systems to surface accesses that would have been denied under the corrected hooks
Correlate mmap() and mprotect() syscall telemetry against overlayfs file paths to identify anomalous mapping behavior

Monitoring Recommendations

Forward auditd SELinux AVC records to a central log store for review of overlayfs-related denials
Track kernel package versions across hosts and containers and alert on systems running pre-fix builds
Monitor for unusual mprotect() transitions to executable on overlay-backed memory regions

How to Mitigate CVE-2026-46054

Immediate Actions Required

Identify all hosts and container nodes running SELinux with overlayfs mounts in use
Apply the upstream kernel patches or vendor-supplied kernel updates that include commits 82544d36b172 and cd0e707a927a
Reboot patched systems to load the corrected kernel and verify the running version

Patch Information

The fix is upstreamed in the Linux kernel stable tree via the initial commit introducing the security_mmap_backing_file() LSM hook and the follow-up commit wiring backing-file enforcement into mprotect(). Apply distribution kernel updates that incorporate both commits.

Workarounds

Where patching is delayed, restrict use of overlayfs to trusted mounters and avoid exposing overlay mounts to confined SELinux domains
Tighten SELinux policy on potentially affected domains to minimize the set of operations available on overlayfs files
Review container runtime configurations to ensure image and volume mounts do not place sensitive backing files within reach of low-trust workloads

bash

# Verify the running kernel and confirm the fix commits are present
uname -r
zcat /proc/config.gz 2>/dev/null | grep -E 'CONFIG_SECURITY_SELINUX|CONFIG_OVERLAY_FS'
ausearch -m AVC -ts recent | grep -i overlay